Setting up StrongSwan on linux

^{Created: 2019-04-16 00:30:42 | Last modified: 2019-04-16 02:38:54} ^{| By: Nova}
^{Access: Read}^{| Visibility: Public}^{| Views: 322}^{| Rating: N/A}^{| Tags: strongswan linux}
Here is a list of basic configuration and debug instructions for StrongSwan on Linux

Install StrongSwan using your package manager, here are some examples of a configuration and then some debugging commands

Configuration

Where 111.111.111.111 is the left (local) network gateway
Where 222.222.222.222 is the right (remote) network gateway
Where 10.80.0.0/24 is the local network
Where 10.30.0.0/24 is the remote network

cd /etc/ipsec.d
vim ipsec.vpn-222.222.222.222.conf

left=111.111.111.111
leftsubnet=10.80.0.0/24
right=222.222.222.222
type=tunnel
authby=secret
keyexchange=ike
ike=aes128-sha1-modp1024
ikelefetime=24h
esp=aes128-sha1
lifetime=1h
keyingtries=2
auto=route
forceencaps=no

vim ipsec.vpn-222.222.222.222.secrets
111.111.111.111 222.222.222.222 : PSK "thepassphrase"

And then do the same for the other end, but just in reverse

cd /etc/ipsec.d
vim ipsec.vpn-111.111.111.111.conf

left=222.222.222.222
leftsubnet=10.30.0.0/24
right=111.111.111.111
type=tunnel
authby=secret
keyexchange=ike
ike=aes128-sha1-modp1024
ikelefetime=24h
esp=aes128-sha1
lifetime=1h
keyingtries=2
auto=route
forceencaps=no

vim ipsec.vpn-111.111.111.111.secrets
222.222.222.222 111.111.111.111 : PSK "thepassphrase"

Debugging

Here is a list of commands to debug OpenSwan

Enable debugging inside OpenSwan (not the space between the left and the charondebug text)

vim /etc/ipsec.conf
    charondebug="ike 2, knl 3, cfg 0"

#Example
# ipsec.conf - strongSwan IPsec configuration file

config setup
    charondebug="ike 2, knl 3, cfg 0"
include /etc/ipsec.d/*.conf

You can also place as a config file inside /etc/ipsec.d/debug.conf if the include is listed as above

Some basic notes to debug IPSEC

#### Debug VPN
tail -f /var/log/auth.log

#Get status of connections
ipsec statusall 

#get ipsec status
service ipsec status 

#view policys
ip xfrm policy 

#view connection details
ipsec auto --status 

#Bring the connection up
ipsec auto --up vpn-111.111.111.111

#View info about the host
tcpdump -i eth3 -n host 172.30.94.90 

#View ipsec messages
tail -f /var/log/messages